Draft for legal review. The operating company's details in [square brackets] are not filled in yet, so this page is not final.
Legal
Subprocessors
[LEGAL ENTITY NAME] ("we", "us", "our") uses the third parties below to run Site Monitor (the "Service"). Where we process personal data on your behalf, the providers in section 1 are our subprocessors under the Data Processing Addendum (the "DPA"), which refers to this page. Each of them processes data under its own written agreement with us.
1. Our subprocessors
| Provider | Purpose | Data involved | Location | Notes |
|---|---|---|---|---|
| Vercel Inc. | Hosts and runs the application: the web pages, sign-in, the scheduled checks and the sending of alerts and reports. | All data that passes through the application, including the requests your browser makes (with your IP address) and the data the application reads and writes. | United States. Requests reach the application through Vercel's global network. | Holds SOC 2 Type 2 and ISO 27001 certifications, as our Security page explains. |
| Upstash Inc. (Redis) | Our database. | Accounts and users (names, email addresses, usernames, password hashes, two-factor secrets and hashed backup codes); websites and their settings; alert settings (recipient email addresses, phone numbers, Slack and webhook addresses, your ClickUp connection and token, your mail server settings and credentials); check results and history; billing status and Stripe identifiers; short-lived sign-in and password reset tokens; a record of the actions our staff take on accounts; and IP addresses used for rate limiting. | United States: Amazon Web Services, N. Virginia (us-east-1), as set in the Upstash console on 2026-10-06. | Connections use TLS. Stored data is not encrypted at the storage layer today: that is an Upstash add-on we have not enabled. |
| Upstash Inc. (QStash) | Schedules the checks every few minutes and delivers the check, report and billing jobs to our application, retrying failed deliveries. | Job messages that carry account and website identifiers and the kind of job. They contain no names, email addresses, website addresses or check results. | United States East (us-east-1) | |
| Stripe Inc. | Payments, subscriptions, tax calculation, invoices and the customer billing portal. | The account owner's email address and the account name; the billing address, tax ID and payment details entered at checkout; subscription and invoice records. | United States | Checkout and the billing portal are pages hosted by Stripe. We store Stripe's identifiers and your subscription status; card numbers are entered with Stripe and never reach our servers. |
| Resend Inc. | Sends the email the Service sends: alerts and reports, trial and billing notices, password reset emails and test emails. | Recipient email addresses and the content of each message, such as website names and addresses, status and times, and your brand name or logo address. | Resend Inc. is a United States company. Our sending domain runs in Resend's Tokyo region (Amazon Web Services ap-northeast-1), so email is processed in Japan, as set in the Resend dashboard on 2026-10-06. | On the Agency and Agency Plus plans you can send alerts and reports through your own mail server instead; Resend then sends those only if your server fails. Password reset emails and trial and billing notices always go through Resend. |
| Twilio Inc. | Sends SMS alerts. | The phone numbers you add for SMS alerts and the text of each alert: the website's name and address and its status. | United States | Used only on the Agency Plus plan, only when SMS is set up on the Service, and only for accounts that add phone numbers. |
2. Services that receive no personal data
Have I Been Pwned (Pwned Passwords). When a login is created or a password is set or reset, our server checks whether the new password appears in known data breaches. Only a five-character prefix of the password's SHA-1 hash leaves our servers: never the password itself, no account data, and not your IP address, because our server makes the request. This service is not a subprocessor.
3. Integrations a customer chooses
The services below receive data only because you set them up in Settings. They are your own processors, not our subprocessors, and their own terms apply. You can remove them at any time.
| Integration | What it receives |
|---|---|
| Slack | Alert messages (the website's name and address, its status and details) posted to the Slack incoming webhook you add. |
| ClickUp | Alert messages posted to the ClickUp Chat channel you connect, using the personal token you give us. |
| Your webhook endpoint | A signed JSON message for each alert: the event, the website's ID, name and address, its status, any error and timing, and your account's ID and name. |
| Your own mail server (SMTP) | Alert and report emails, with their recipient addresses and content, sent through the server and credentials you give us. |
4. Other services your browser contacts
Our pages load their fonts, scripts and styles from our own servers. Your browser contacts other addresses only when you use a feature that needs them: Stripe's hosted pages for checkout and billing, and a customer's own logo image on a public status page. Our Cookie Policy has more detail.
5. Changes to this list
- We will email account owners at least 30 days before a new or replacement subprocessor starts handling customer data, and update this page.
- If you object to a change on reasonable data protection grounds, email privacy@concepcion.work within that notice period. The DPA explains how objections are handled.
- This list was last updated on October 6, 2026.